rustfs/rustfs · error · EnrollmentError

TRUST_CHAIN_INVALID

TRUST_CHAIN_INVALID

Error message

a trust link is invalid, misordered, or outside its validity at the challenge issuedAt

What it means

The offline-enrollment trust chain failed validation: a link is malformed, the links are misordered, or a link's validity window does not cover the challenge's issuedAt time. The at-fault input is the supplied trust-chain in the enrollment payload.

Source

Thrown at rustfs/src/connect/offline/enrollment.rs:175

/// the exchange. The device half implemented here produces the encoding, chain,
/// version, and freshness reasons; the reasons that describe a response being
/// evaluated against stored state — [`Self::ChallengeUnknown`],
/// [`Self::ChallengeProofInvalid`], [`Self::DeviceProofInvalid`],
/// [`Self::EnrollmentReplayed`], [`Self::OrganizationMismatch`], and
/// [`Self::ClusterMismatch`] — are Connect's to raise and are named here so the
/// two sides share one vocabulary.
///
/// No variant carries a payload: a rejection must never disclose key material,
/// signature octets, nonces, or document bytes.
#[derive(Debug, PartialEq, Eq, thiserror::Error)]
pub enum EnrollmentError {
    #[error("protocolVersion is missing, malformed, or names an unsupported major version")]
    UnsupportedProtocol,

    #[error("formatVersion is not a supported offline enrollment format")]
    UnsupportedFormat,

    #[error("the signature is not 64 octets of fixed-width r||s in unpadded base64url")]
    SignatureMalformed,

    #[error("the signature is not in its canonical low-S form")]
    SignatureNotCanonical,

    #[error("the signature does not verify over the received octets")]
    SignatureInvalid,

    #[error("the trust chain is not issued by a root pinned in this build")]
    EnrollmentRootUnknown,

    #[error("a trust link is invalid, misordered, or outside its validity at the challenge issuedAt")]
    TrustChainInvalid,

    #[error("connectKeyId is not the subject of the last trust link")]
    ConnectKeyUnchained,

    #[error("no issued challenge matches this challengeId")]

View on GitHub (pinned to 5dca076efe)

Solutions

  1. Regenerate the artifact ensuring the chain is ordered leaf-to-root
  2. Verify intermediate certificates are within validity at issuance time
  3. Obtain a freshly issued artifact if intermediates have expired
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at rustfs/src/connect/offline/enrollment.rs:171 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of rustfs/rustfs@5dca076efe (2026-08-23). Data as JSON: /api/errors/9706123a178114fb. Report an issue: GitHub.